Arbitrary Code Execution

dovecot is vulnerable to arbitrary code execution. A buffer overflow vulnerability in the indexer-worker process allows an attacker to execute arbitary code on the system...

dovecot: Buffer overflow in indexer-worker process results in privilege escalation

In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components...

Option to Install Veeam ONE Agent is Unavailable (Greyed Out)

Challenge When attempting to install the Veeam ONE Agent on a Veeam Backup Server, theInstall agent option is unavailable and greyed out. Cause There are several possible causes for this issue: The Veeam ONE Agent is already installed on the Veeam Backup & Replication Server. The Veeam ONE Server...

Design/Logic Flaw

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

CVE-2015-4411

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

CVE-2015-4411

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

CVE-2015-4411

CVE-2015-4411 affects the MongoDB Ruby stack: the Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 (used by rubygem-moped) allows remote denial of service via a crafted string, due to an incomplete fix to CVE-2015-4410. Impact is a targeted DoS via resource consumption; no exp...

SUSE-SU-2020:0353-1 Security update for systemd

This update for systemd provides the following fixes: - CVE-2020-1712 bscbsc1162108 Fix a heap use-after-free vulnerability, when asynchronous Polkit queries were performed while handling Dbus messages. A local unprivileged attacker could have abused this flaw to crash systemd services or...

RHEL 8 : thunderbird (RHSA-2020:0292)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0292 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 68.4.1. Security Fixes: Mozilla:...

Mozilla: Use-after-free in worker destruction

When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3, and Firefox 71...

Huawei EulerOS: Security Advisory for dovecot (EulerOS-SA-2019-1644)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Abusing the Service Workers API

The Service Worker web API is a powerful new API for web browsers. During our research, we have found several ways attackers can leverage this API to enhance their low-to-medium risk findings into a powerful and meaningful attack. By...

CVE-2019-19241

In the Linux kernel before 5.4.2, the iouring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/iouring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to...

The New Year Calls for a Change in the OT Industry’s State of Security

In 2014, a Western European steel mill suffered serious damage from a phishing attack that penetrated its IT and Operational Technology OT networks the software and hardware dedicated to monitoring and controlling physical devices where attackers gained control of plant equipment. In 2018, 74% of...

CentOS 7 : thunderbird (CESA-2019:4148)

An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

thunderbird security update

CentOS Errata and Security Advisory CESA-2019:4148 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:3347-1)

This update for MozillaFirefox fixes the following issues : Mozilla Firefox was updated to 68.3esr MFSA 2019-37 bsc1158328 Security issues fixed : CVE-2019-17008: Fixed a use-after-free in worker destruction bmo1546331 CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments ...

CVE-2019-8725

The issue was addressed with improved handling of service worker lifetime. This issue is fixed in Safari 13.0.1. Service workers may leak private browsing history...

CVE-2019-8725

The issue was addressed with improved handling of service worker lifetime. This issue is fixed in Safari 13.0.1. Service workers may leak private browsing history...

CVE-2019-8725

The CVE-2019-8725 issue affects Apple Safari (WebKit) and relates to service workers leaking private browsing history due to improper handling of service worker lifetime. The vulnerability is addressed in Safari 13.0.1, with Apple’s advisory listing the Service Workers fix under that update. Conn...